From a145861ad1c2650c58dd3ff0dbd92ae6f41f1e1b Mon Sep 17 00:00:00 2001
From: Kaylee Lubick <[email protected]>
Date: Fri, 05 Jun 2026 20:51:04 +0000
Subject: [PATCH] Reject Slugs that have creationMatrix with perspective

This shouldn't happen during normal use [1] but if the data
is corrupted, there are some assumptions that can can cause
issues, like the ones linked in the bug.

This rejects those and turns one assert into an actual runtime
check to provide defense in depth.

[1] https://github.com/google/skia/blob/9eecbdc30f7da675edab96974b23174a9d521e0c/src/text/gpu/SubRunContainer.cpp#L1578-L1581

Bug: 520113415
Fixed: 520113415
Change-Id: I6ec23df9a23ea588fa89f7a62dc1f197fe3905fd
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1256016
Commit-Queue: Kaylee Lubick <[email protected]>
Reviewed-by: Thomas Smith <[email protected]>
---

diff --git a/src/gpu/ganesh/ops/AtlasTextOp.cpp b/src/gpu/ganesh/ops/AtlasTextOp.cpp
index 27e919e..51ae890 100644
--- a/src/gpu/ganesh/ops/AtlasTextOp.cpp
+++ b/src/gpu/ganesh/ops/AtlasTextOp.cpp
@@ -565,11 +565,16 @@
 
         auto& glyphData = subRun.glyphVector().accessBackendData<GlyphData>();
 
-        SkDEBUGCODE(int strideCheck = SkToInt(glyphData.vertexStride(subRun.maskFormat(),
-                                                                     geo->fDrawMatrix)));
-        SkASSERTF(strideCheck == vertexStride,
-                   "subRun stride: %d vertex buffer stride: %d\n",
-                   strideCheck, vertexStride);
+        int strideCheck = SkToInt(glyphData.vertexStride(subRun.maskFormat(), geo->fDrawMatrix));
+        if (strideCheck != vertexStride) {
+            // We (unexpectedly) have buffers of different sizes between CPU and GPU. Bail out.
+            SKIA_LOG_D(
+                    "Warning: stride mismatch detected (subrun stride: %d vertex buffer stride: "
+                    "%d). Aborting draw.\n",
+                    strideCheck,
+                    vertexStride);
+            return;
+        }
 
         const int subRunEnd = subRun.glyphCount();
 
diff --git a/src/text/gpu/SubRunContainer.cpp b/src/text/gpu/SubRunContainer.cpp
index bd5f827..6d2a7e3 100644
--- a/src/text/gpu/SubRunContainer.cpp
+++ b/src/text/gpu/SubRunContainer.cpp
@@ -169,6 +169,11 @@
 
     SkMatrix creationMatrix;
     buffer.readMatrix(&creationMatrix);
+    // The only valid creationMatrices do not have perspective and many rendering parts assume
+    // they are non-affine, so reject any malformed matrices here.
+    if (!buffer.validate(!creationMatrix.hasPerspective())) {
+        return std::nullopt;
+    }
 
     SkSpan<SkPoint> leftTop = make_points_from_buffer(buffer, alloc);
     if (leftTop.empty()) {
diff --git a/tests/SlugTest.cpp b/tests/SlugTest.cpp
index cc1ef79..1c81925 100644
--- a/tests/SlugTest.cpp
+++ b/tests/SlugTest.cpp
@@ -5,6 +5,8 @@
  * found in the LICENSE file.
  */
 
+#include "include/core/SkBitmap.h"
+#include "include/core/SkCanvas.h"
 #include "include/core/SkFont.h"
 #include "include/core/SkFontStyle.h"
 #include "include/core/SkFontTypes.h"
@@ -20,6 +22,8 @@
 #include "include/gpu/ganesh/SkSurfaceGanesh.h"
 #include "include/private/base/SkTDArray.h"
 #include "include/private/chromium/Slug.h"
+#include "src/text/gpu/SlugImpl.h"
+#include "src/utils/SkFloatUtils.h"
 #include "tests/CtsEnforcement.h"
 #include "tests/Test.h"
 #include "tools/ToolUtils.h"
@@ -65,3 +69,84 @@
     sk_sp<sktext::gpu::Slug> slug = sktext::gpu::Slug::ConvertBlob(canvas, *blob, {10, 10}, p);
     REPORTER_ASSERT(reporter, slug == nullptr);
 }
+
+static void set_sdf_options(GrContextOptions* options) {
+    options->fMinDistanceFieldFontSize = 4;
+    options->fGlyphsAsPathsFontSize = 256;
+    options->fSupportBilerpFromGlyphAtlas = true;
+}
+
+DEF_GANESH_TEST_FOR_CONTEXTS(Slug_b520113415,
+                             skgpu::IsRenderingContext,
+                             reporter,
+                             ctxInfo,
+                             set_sdf_options,
+                             CtsEnforcement::kNextRelease) {
+    auto dContext = ctxInfo.directContext();
+
+    SkImageInfo info = SkImageInfo::MakeN32Premul(256, 256);
+    auto surface = SkSurfaces::RenderTarget(dContext, skgpu::Budgeted::kNo, info);
+    REPORTER_ASSERT(reporter, surface);
+    auto canvas = surface->getCanvas();
+
+    // This matrix is big enough such that with the font below...
+    SkMatrix canvasMatrix = SkMatrix::Scale(1.2345f, 6.7890f);
+
+    canvas->save();
+    canvas->setMatrix(canvasMatrix);
+
+    //  ... it will force SDFT (6.789 x 24 = ~162.9).
+    auto typeface = ToolUtils::CreatePortableTypeface("serif", SkFontStyle());
+    SkFont font(typeface);
+    font.setSubpixel(true);
+    font.setSize(24);
+
+    static const char* kText = "A";
+    int glyphCount = font.countText(kText, 1, SkTextEncoding::kUTF8);
+    SkTDArray<SkGlyphID> glyphs;
+    glyphs.append(glyphCount);
+    font.textToGlyphs(kText, 1, SkTextEncoding::kUTF8, glyphs);
+
+    SkTextBlobBuilder builder;
+    const SkTextBlobBuilder::RunBuffer& buf = builder.allocRun(font, glyphs.size(), 0, 0);
+    memcpy(buf.glyphs, glyphs.begin(), glyphs.size() * sizeof(SkGlyphID));
+    auto blob = builder.make();
+
+    SkPaint paint;
+    paint.setAntiAlias(true);
+
+    sk_sp<sktext::gpu::Slug> slug = sktext::gpu::Slug::ConvertBlob(canvas, *blob, {0, 0}, paint);
+    canvas->restore();
+
+    if (!slug) {
+        return;
+    }
+
+    sk_sp<SkData> data = slug->serialize();
+    if (!data || data->size() == 0) {
+        return;
+    }
+
+    // Copy data to a writable buffer so we can corrupt it
+    size_t size = data->size();
+    std::unique_ptr<uint8_t[]> writableData(new uint8_t[size]);
+    memcpy(writableData.get(), data->data(), size);
+
+
+    // The creationMatrix of VertexFiller inside SDFTSubRun is located 216 bytes in.
+    // We can overwrite it to have a matrix with perspective.
+    if (size < 216 + 9 * sizeof(float)) {
+        ERRORF(reporter, "Serialized Slug is too small to contain creationMatrix!");
+        return;
+    }
+    float* f = reinterpret_cast<float*>(writableData.get() + 216);
+    f[0] = 1.0f; f[1] = 0.0f; f[2] = 0.0f;
+    f[3] = 0.0f; f[4] = 1.0f; f[5] = 0.0f;
+    f[6] = 0.0078125f; f[7] = 0.0f; f[8] = 1.0f;
+
+    // Deserialize the forged slug. This should return nullptr. Previously, when we went to draw it,
+    // the perspective would cause issues.
+    sk_sp<sktext::gpu::Slug> forgedSlug =
+            sktext::gpu::Slug::Deserialize(writableData.get(), size, nullptr);
+    REPORTER_ASSERT(reporter, forgedSlug == nullptr);
+}